Financial Key Download Using ECDH Multi-Stage Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing financial key download methods using RSA2048 algorithm lack robust security measures, particularly in ensuring secure data transmission and authentication during the financial certificate and key download process in POS machines.
Innovation Solution
Implementing an Elliptic Curve Diffie–Hellman (ECDH) key negotiation algorithm for session key negotiation between a key distribution host and a key receiving device to establish multiple secure channels, ensuring two-way authentication before downloading financial certificates and keys, involving multiple session key negotiations and message authentication codes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If RSA2048 algorithm is used for key generation and authentication, then the financial key download can be performed, but the security of data transmission during the download process is insufficient
Solution Approach 1:
The authentication process is segmented into multiple independent stages: first authentication before certificate download, and second authentication before financial key download. Each stage uses separate session keys (first session key and second session key) established through ECDH key negotiation, allowing the system to enhance security without creating a monolithic complex authentication mechanism.
Solution Approach 2:
The patent performs preliminary authentication and session key establishment before the actual certificate and key download operations. The first session key is established before certificate download, and the second session key is established before financial key download, ensuring that security measures are in place before sensitive data transmission begins.
2Reliability
If single authentication protocol is used for financial key download, then the process is simple, but two-way authentication cannot be ensured
Solution Approach 1:
The authentication process is divided into two distinct phases: first authentication between key distribution host and key receiving device before certificate download, and second authentication after certificate download but before financial key download. Each phase has its own session key and authentication flow, ensuring two-way authentication while maintaining clear temporal separation.
Solution Approach 2:
The financial certificate acts as an intermediary element between the two authentication phases. The certificate is downloaded in the first phase and then used as a credential in the second phase, serving as a bridge that enables progressive authentication without requiring both authentication processes to occur simultaneously.
3Reliability
If RSA2048 algorithm is used for session key generation, then the key download can be completed, but the security channel establishment is insufficient
Solution Approach 1:
The patent changes the cryptographic parameters from RSA2048 to ECDH (Elliptic Curve Diffie-Hellman) for session key generation. This parameter change provides stronger security properties for key negotiation while maintaining compatibility with existing cryptographic infrastructure. The ECDH algorithm offers enhanced security for the same key length compared to RSA.
Data Source
AI summary
A financial certificate and financial key download method is provided. The method comprises: performing a session key negotiation between a key distribution host end and a key receiving device end using an ECDH key negotiation algorithm to obtain a first session key; sending, via the key receiving device end, a financial certificate download request to the key distribution host end; generating, via the key distribution host end, a financial certificate , and sending to the key receiving device end; performing a session key negotiation between the key distribution host end and the key receiving device end based on the financial certificate again to obtain a second session key; sending, via the key receiving device end, a financial key download request to the key distribution host end; and generating, via the key distribution host end, a financial key, and sending to the key receiving device end.